Doh! Thanks. The syntax between tcp and syslog declarations strikes me as a bit irregular - one takes ip() as an argument and the other does not. Cheers, Jan
________________________________ From: Jakub Jankowski <shasta@toxcorp.com> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Wednesday, December 7, 2011 12:13 PM Subject: Re: [syslog-ng] Invalid frame header messages
Wednesday 07 of December 2011 17:26:06 Mr. Jan Walter wrote:
I compiled version 3.3.3 and tried getting a client and server to talk based on the documentation on the balabit site, specifically the documentation for OSE version 3.3.
The server config file: -- source remotelogs { syslog( port(2072) transport(tcp) ); } ;
You are using syslog() source driver on your server, but...
And the client sending: -- [...] destination loghost { tcp(10.195.105.214 port(2072) ); };
... plain tcp() destination driver on your client. Change it to syslog() so they match.
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guide...
HTH
-- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq